Configuration free certs #4584
Configuration free certs #4584
Conversation
Certificate are stored in nssdb of the instance so the copy in the file is redundant and will be removed.
When working with HSM the Lightweight CA access the root CA certificate from the CS.cfg. This has been modified reading the certificate from NSSDB to allow the removal of such field from the configuration. NOTE: Currently, Lightweight CA does not work with HSM so this change cannot be really tested until the Github issue dogtagpki#2412 is fixed.
base/ca/src/main/java/com/netscape/ca/CertificateAuthority.java
Outdated
Show resolved
Hide resolved
base/ca/src/main/java/com/netscape/ca/CertificateAuthority.java
Outdated
Show resolved
Hide resolved
|
@rcritten FYI, with this change PKI will no longer store cert data in the @fmarco76 Once IPA is no longer checking/updating the params, we can add an upgrade script to remove the params from existing installations. |
For the script I would complete with the elimination of the CSR. For that I am not sure yet if it can be just removed or we need to keep a copy. After I will see for the upgrade script. |
|
There is a pki healthcheck that compares the values. That needs to be removed as well. It may well be all of base/server/healthcheck/pki/server/healthcheck/meta/csconfig.py but definitely including CADogtagCertsConfigCheck, OCSPDogtagCertsConfigCheck, KRADogtagCertsConfigCheck, TKSDogtagCertsConfigCheck, TPSDogtagCertsConfigCheck, |
fmarco76
force-pushed
the
ConfigurationFreeCerts
branch
from
dda04c8 to
c89c3c2
Compare
|
Kudos, SonarCloud Quality Gate passed! |
|
@edewata Thanks! |
Subsystem certificates were stored in the
CS.cfgconfiguration file and NSSDB storage. This is useless and could create problem is they are not synced.Therefore the certificates will not be stored in CS.cfg during the installation and all the requests will read the certificate from the NSSDB.
This partially implemented https://issues.redhat.com/browse/RHCS-3451, the certreq has the same problem and need to be removed from configuration files.
Fix #2157